examples/operator-rbac/2-client-rbac-test-pod.ipynb

{
 "cells": [
  {
   "metadata": {},
   "cell_type": "markdown",
   "source": [
    "## Feast Client with RBAC\n",
    "\n",
    "## Feast Kubernetes RBAC Authorization\n",
    "\n",
    "Feast **Role-Based Access Control (RBAC)** in Kubernetes relies on a **service account** for authentication. This applies both **within a Kubernetes pod** and for **external clients** accessing Feast\n",
    "\n",
    "In this example, Feast will automatically retrieve the Kubernetes ServiceAccount token from pod path:\n",
    "```\n",
    "/var/run/secrets/kubernetes.io/serviceaccount/token\n",
    "```\n",
    "This means:\n",
    "- No manual configuration is needed inside a pod.\n",
    "- The token is mounted automatically and used for authentication.\n",
    "- Developer?User just need create the binding with role and service account accordingly.\n",
    "\n",
    "For more details, refer to the user guide: [Kubernetes RBAC Authorization](https://docs.feast.dev/master/getting-started/components/authz_manager#kubernetes-rbac-authorization). \n"
   ],
   "id": "bb0145c9c1f6ebcc"
  },
  {
   "metadata": {},
   "cell_type": "markdown",
   "source": [
    "###  Feature Store settings\n",
    "**The Operator create client ConfigMap** containing the `feature_store.yaml `settings. We can retrieve it save it feature_repo folder."
   ],
   "id": "6590c081efb1fe3c"
  },
  {
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-14T15:00:28.986653Z",
     "start_time": "2025-03-14T15:00:28.670157Z"
    }
   },
   "cell_type": "code",
   "source": [
    "!kubectl get configmap feast-sample-kubernetes-auth-client -n feast -o jsonpath='{.data.feature_store\\.yaml}' > client/feature_repo/feature_store.yaml\n",
    "!cat  client/feature_repo/feature_store.yaml"
   ],
   "id": "456fb4df46f32380",
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "project: feast_rbac\r\n",
      "provider: local\r\n",
      "offline_store:\r\n",
      "    host: feast-sample-kubernetes-auth-offline.feast.svc.cluster.local\r\n",
      "    type: remote\r\n",
      "    port: 80\r\n",
      "online_store:\r\n",
      "    path: http://feast-sample-kubernetes-auth-online.feast.svc.cluster.local:80\r\n",
      "    type: remote\r\n",
      "registry:\r\n",
      "    path: feast-sample-kubernetes-auth-registry.feast.svc.cluster.local:80\r\n",
      "    registry_type: remote\r\n",
      "auth:\r\n",
      "    type: kubernetes\r\n",
      "entity_key_serialization_version: 3\r\n"
     ]
    }
   ],
   "execution_count": 20
  },
  {
   "metadata": {},
   "cell_type": "markdown",
   "source": [
    "**Create ConfigMap From Feature Repository**  \n",
    "We need feature_repo inside the container. let's create configmap from `feature_repo` contains the feature repository files, including `feature-store.yaml` and `test.py`. It will be mounted as a volume in the deployment for the client examples to test the script."
   ],
   "id": "84f73e09711bff9f"
  },
  {
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-14T15:02:03.243912Z",
     "start_time": "2025-03-14T15:02:02.804431Z"
    }
   },
   "cell_type": "code",
   "source": [
    "!kubectl delete configmap client-feature-repo-config --ignore-not-found -n feast \n",
    "!kubectl create configmap client-feature-repo-config --from-file=client/feature_repo -n feast"
   ],
   "id": "b840ac6ea3b95e90",
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "configmap/client-feature-repo-config created\r\n"
     ]
    }
   ],
   "execution_count": 21
  },
  {
   "metadata": {},
   "cell_type": "markdown",
   "source": [
    "### Test Read-Only Feast User \n",
    "\n",
    "**Step 1: Deploy read-only user, we are using `serviceAccountName  feast-user-sa` in deployment.**\n"
   ],
   "id": "84e3f83699b8d83"
  },
  {
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-14T15:03:23.308812Z",
     "start_time": "2025-03-14T15:03:22.868434Z"
    }
   },
   "cell_type": "code",
   "source": [
    "# Create the deployment \n",
    "!cat client/readonly_user_deployment.yaml\n",
    "!kubectl apply -f \"client/readonly_user_deployment.yaml\"\n"
   ],
   "id": "14b7ad38368db767",
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: apps/v1\r\n",
      "kind: Deployment\r\n",
      "metadata:\r\n",
      "  name: client-readonly-user\r\n",
      "  namespace: feast\r\n",
      "  labels:\r\n",
      "    app: client-user\r\n",
      "spec:\r\n",
      "  replicas: 1\r\n",
      "  selector:\r\n",
      "    matchLabels:\r\n",
      "      app: client-user\r\n",
      "  template:\r\n",
      "    metadata:\r\n",
      "      labels:\r\n",
      "        app: client-user\r\n",
      "    spec:\r\n",
      "      serviceAccountName: feast-user-sa\r\n",
      "      containers:\r\n",
      "        - name: client-user-container\r\n",
      "          image: quay.io/feastdev/feature-server:latest\r\n",
      "          imagePullPolicy: Always\r\n",
      "          command: [\"sleep\", \"infinity\"]\r\n",
      "          volumeMounts:\r\n",
      "            - name: client-feature-repo-config\r\n",
      "              mountPath: /opt/app-root/src\r\n",
      "      volumes:\r\n",
      "        - name: client-feature-repo-config\r\n",
      "          configMap:\r\n",
      "            name: client-feature-repo-config\r\n",
      "deployment.apps/client-readonly-user created\r\n"
     ]
    }
   ],
   "execution_count": 22
  },
  {
   "metadata": {},
   "cell_type": "markdown",
   "source": "**Step 2: Run test.py script for client-readonly-user, readonly-user can only read or query all objects.**",
   "id": "3b2f60e1fd32c0a5"
  },
  {
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-14T15:03:43.446664Z",
     "start_time": "2025-03-14T15:03:31.105949Z"
    }
   },
   "cell_type": "code",
   "source": [
    "#Run test.py script from pod to test RBAC for client-readonly-user.\n",
    "# verify the logs for write operation will show below message \n",
    "# --- Write to Feature Store ---\n",
    "#*** PERMISSION DENIED *** User lacks permission to modify the feature store.\n",
    "\n",
    "!kubectl exec -n feast -it $(kubectl get pods -n feast -l app=client-user -o jsonpath=\"{.items[0].metadata.name}\") -- python test.py\n"
   ],
   "id": "c33f1966259a8a18",
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<jemalloc>: MADV_DONTNEED does not work (memset will be used instead)\r\n",
      "<jemalloc>: (This is the expected behaviour if you are running under QEMU)\r\n",
      "\r\n",
      "--- List feature views ---\r\n",
      "Successfully listed 2 feature views:\r\n",
      "  - driver_hourly_stats\r\n",
      "  - driver_hourly_stats_fresh\r\n",
      "\r\n",
      "--- Fetching Historical Features for Training ---\r\n",
      "Successfully fetched training historical features:\r\n",
      "    driver_id  ... conv_rate_plus_val2\r\n",
      "0       1001  ...           10.229559\r\n",
      "1       1002  ...           20.697800\r\n",
      "2       1003  ...           30.933721\r\n",
      "\r\n",
      "[3 rows x 10 columns]\r\n",
      "\r\n",
      "--- Fetching Historical Features for Batch Scoring ---\r\n",
      "Successfully fetched batch scoring historical features:\r\n",
      "    driver_id  ... conv_rate_plus_val2\r\n",
      "0       1002  ...           20.445888\r\n",
      "1       1001  ...           10.815464\r\n",
      "2       1003  ...           30.287972\r\n",
      "\r\n",
      "[3 rows x 10 columns]\r\n",
      "\r\n",
      "--- Write to Feature Store ---\r\n",
      "\r\n",
      "*** PERMISSION DENIED *** User lacks permission to modify the feature store.\r\n",
      "\r\n",
      "--- Fetching Online Features ---\r\n",
      "Successfully fetched online features directly:\r\n",
      "\r\n",
      "acc_rate : [None, None]\r\n",
      "conv_rate_plus_val1 : [None, None]\r\n",
      "conv_rate_plus_val2 : [None, None]\r\n",
      "driver_id : [1001, 1002]\r\n",
      "\r\n",
      "--- Fetching Online Features via Feature Service ---\r\n",
      "Successfully fetched online features via feature service:\r\n",
      "\r\n",
      "conv_rate : [None, None]\r\n",
      "conv_rate_plus_val1 : [None, None]\r\n",
      "conv_rate_plus_val2 : [None, None]\r\n",
      "driver_id : [1001, 1002]\r\n",
      "\r\n",
      "--- Fetching Online Features via Push Source ---\r\n",
      "Successfully fetched online features via feature service:\r\n",
      "\r\n",
      "acc_rate : [None, None]\r\n",
      "avg_daily_trips : [None, None]\r\n",
      "conv_rate : [None, None]\r\n",
      "conv_rate_plus_val1 : [None, None]\r\n",
      "conv_rate_plus_val2 : [None, None]\r\n",
      "driver_id : [1001, 1002]\r\n",
      "\r\n",
      "--- Performing Push Source ---\r\n",
      "Unexpected error while pushing event: \r\n",
      "Exception ignored in: <function RemoteRegistry.__del__ at 0x40421e44a0>\r\n",
      "Traceback (most recent call last):\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/feast/infra/registry/remote.py\", line 111, in __del__\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/feast/infra/registry/remote.py\", line 108, in close\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/grpc/_interceptor.py\", line 782, in close\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/grpc/_channel.py\", line 2250, in close\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/grpc/_channel.py\", line 2231, in _close\r\n",
      "AttributeError: 'NoneType' object has no attribute 'StatusCode'\r\n"
     ]
    }
   ],
   "execution_count": 23
  },
  {
   "metadata": {},
   "cell_type": "markdown",
   "source": "### Test Unauthorized Feast User ",
   "id": "e5e63a172da6d6d7"
  },
  {
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-14T15:05:21.599673Z",
     "start_time": "2025-03-14T15:05:21.286300Z"
    }
   },
   "cell_type": "code",
   "source": "!kubectl apply -f \"client/unauthorized_user_deployment.yaml\"",
   "id": "7fb94439606b4077",
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps/client-unauthorized-user created\r\n"
     ]
    }
   ],
   "execution_count": 24
  },
  {
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-14T15:05:36.709759Z",
     "start_time": "2025-03-14T15:05:26.828228Z"
    }
   },
   "cell_type": "code",
   "source": "!kubectl exec -n feast -it $(kubectl get pods -n feast -l app=client-unauthorized-user -o jsonpath=\"{.items[0].metadata.name}\") -- python test.py",
   "id": "7aea5658325ab008",
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<jemalloc>: MADV_DONTNEED does not work (memset will be used instead)\r\n",
      "<jemalloc>: (This is the expected behaviour if you are running under QEMU)\r\n",
      "/opt/app-root/lib64/python3.11/site-packages/feast/feature_view.py:48: DeprecationWarning: Entity value_type will be mandatory in the next release. Please specify a value_type for entity '__dummy'.\r\n",
      "  DUMMY_ENTITY = Entity(\r\n",
      "\r\n",
      "--- List feature views ---\r\n",
      "No feature views found. You might not have access or they haven't been created.\r\n",
      "\r\n",
      "--- Fetching Historical Features for Training ---\r\n",
      "\r\n",
      "*** PERMISSION DENIED *** Cannot fetch historical features.\r\n",
      "\r\n",
      "--- Fetching Historical Features for Batch Scoring ---\r\n",
      "\r\n",
      "*** PERMISSION DENIED *** Cannot fetch historical features.\r\n",
      "\r\n",
      "--- Write to Feature Store ---\r\n",
      "\r\n",
      "*** PERMISSION DENIED *** User lacks permission to modify the feature store.\r\n",
      "\r\n",
      "--- Fetching Online Features ---\r\n",
      "\r\n",
      "*** PERMISSION DENIED *** Cannot fetch online features.\r\n",
      "\r\n",
      "--- Fetching Online Features via Feature Service ---\r\n",
      "\r\n",
      "*** PERMISSION DENIED *** Cannot fetch online features.\r\n",
      "\r\n",
      "--- Fetching Online Features via Push Source ---\r\n",
      "\r\n",
      "*** PERMISSION DENIED *** Cannot fetch online features.\r\n",
      "\r\n",
      "--- Performing Push Source ---\r\n",
      "Unexpected error while pushing event: Unable to find push source 'driver_stats_push_source'.\r\n",
      "Exception ignored in: <function RemoteRegistry.__del__ at 0x4041ad4400>\r\n",
      "Traceback (most recent call last):\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/feast/infra/registry/remote.py\", line 111, in __del__\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/feast/infra/registry/remote.py\", line 108, in close\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/grpc/_interceptor.py\", line 782, in close\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/grpc/_channel.py\", line 2250, in close\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/grpc/_channel.py\", line 2231, in _close\r\n",
      "AttributeError: 'NoneType' object has no attribute 'StatusCode'\r\n"
     ]
    }
   ],
   "execution_count": 25
  },
  {
   "metadata": {},
   "cell_type": "markdown",
   "source": "## Test Admin Feast User",
   "id": "cb78ced7c37ceb4c"
  },
  {
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-14T15:05:48.131836Z",
     "start_time": "2025-03-14T15:05:47.921200Z"
    }
   },
   "cell_type": "code",
   "source": "!kubectl apply -f \"client/admin_user_deployment.yaml\"",
   "id": "2ee693d2436e282a",
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps/client-admin-user created\r\n"
     ]
    }
   ],
   "execution_count": 26
  },
  {
   "metadata": {
    "ExecuteTime": {
     "end_time": "2025-03-14T15:06:04.283659Z",
     "start_time": "2025-03-14T15:05:51.977649Z"
    }
   },
   "cell_type": "code",
   "source": "!kubectl exec -n feast -it $(kubectl get pods -n feast -l app=client-admin -o jsonpath=\"{.items[0].metadata.name}\") -- python test.py\n",
   "id": "7a6133f052b9cfe1",
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<jemalloc>: MADV_DONTNEED does not work (memset will be used instead)\r\n",
      "<jemalloc>: (This is the expected behaviour if you are running under QEMU)\r\n",
      "\r\n",
      "--- List feature views ---\r\n",
      "Successfully listed 2 feature views:\r\n",
      "  - driver_hourly_stats\r\n",
      "  - driver_hourly_stats_fresh\r\n",
      "\r\n",
      "--- Fetching Historical Features for Training ---\r\n",
      "Successfully fetched training historical features:\r\n",
      "    driver_id  ... conv_rate_plus_val2\r\n",
      "0       1001  ...           10.229559\r\n",
      "1       1002  ...           20.697800\r\n",
      "2       1003  ...           30.933721\r\n",
      "\r\n",
      "[3 rows x 10 columns]\r\n",
      "\r\n",
      "--- Fetching Historical Features for Batch Scoring ---\r\n",
      "Successfully fetched batch scoring historical features:\r\n",
      "    driver_id  ... conv_rate_plus_val2\r\n",
      "0       1002  ...           20.445888\r\n",
      "1       1001  ...           10.815464\r\n",
      "2       1003  ...           30.287972\r\n",
      "\r\n",
      "[3 rows x 10 columns]\r\n",
      "\r\n",
      "--- Write to Feature Store ---\r\n",
      "User has write access to the feature store.\r\n",
      "\r\n",
      "--- Fetching Online Features ---\r\n",
      "Successfully fetched online features directly:\r\n",
      "\r\n",
      "acc_rate : [None, None]\r\n",
      "conv_rate_plus_val1 : [None, None]\r\n",
      "conv_rate_plus_val2 : [None, None]\r\n",
      "driver_id : [1001, 1002]\r\n",
      "\r\n",
      "--- Fetching Online Features via Feature Service ---\r\n",
      "Successfully fetched online features via feature service:\r\n",
      "\r\n",
      "conv_rate : [None, None]\r\n",
      "conv_rate_plus_val1 : [None, None]\r\n",
      "conv_rate_plus_val2 : [None, None]\r\n",
      "driver_id : [1001, 1002]\r\n",
      "\r\n",
      "--- Fetching Online Features via Push Source ---\r\n",
      "Successfully fetched online features via feature service:\r\n",
      "\r\n",
      "acc_rate : [None, None]\r\n",
      "avg_daily_trips : [None, None]\r\n",
      "conv_rate : [None, None]\r\n",
      "conv_rate_plus_val1 : [None, None]\r\n",
      "conv_rate_plus_val2 : [None, None]\r\n",
      "driver_id : [1001, 1002]\r\n",
      "\r\n",
      "--- Performing Push Source ---\r\n",
      "Unexpected error while pushing event: \r\n",
      "Exception ignored in: <function RemoteRegistry.__del__ at 0x40414cc4a0>\r\n",
      "Traceback (most recent call last):\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/feast/infra/registry/remote.py\", line 111, in __del__\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/feast/infra/registry/remote.py\", line 108, in close\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/grpc/_interceptor.py\", line 782, in close\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/grpc/_channel.py\", line 2250, in close\r\n",
      "  File \"/opt/app-root/lib64/python3.11/site-packages/grpc/_channel.py\", line 2231, in _close\r\n",
      "AttributeError: 'NoneType' object has no attribute 'StatusCode'\r\n"
     ]
    }
   ],
   "execution_count": 27
  },
  {
   "metadata": {},
   "cell_type": "markdown",
   "source": "[Next: Client example on local](./3-client-rbac-test-local.ipynb)",
   "id": "38c54e92643e0bda"
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 2
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython2",
   "version": "2.7.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}